Hi,
On 08/09/2017 10:25, Laszlo Ersek wrote:
Ray,
On 09/08/17 14:41, Paulo Alcantara wrote:
v6:
- Fixed a bug in UdfRead() that'd pontentially break in ARM or IA32
by allowing caller to read more than 4GiB of data
(i.e. BufferSize pointer is dereferenced as an UINT64 * and it's
followed by 4 bytes that are nonzero).
Repo: https://github.com/pcacjr/edk2.git
Branch: udf-fs-v6
The v5-v6 diff is as follows:
diff --git a/MdeModulePkg/Universal/Disk/UdfDxe/File.c
b/MdeModulePkg/Universal/Disk/UdfDxe/File.c
index 2dbcff0be4a3..8b9339567f8e 100644
--- a/MdeModulePkg/Universal/Disk/UdfDxe/File.c
+++ b/MdeModulePkg/Universal/Disk/UdfDxe/File.c
@@ -325,8 +325,9 @@ UdfRead (
UDF_FILE_IDENTIFIER_DESCRIPTOR *NewFileIdentifierDesc;
VOID *NewFileEntryData;
CHAR16 FileName[UDF_FILENAME_LENGTH] = { 0 };
UINT64 FileSize;
+ UINT64 BufferSizeUint64;
OldTpl = gBS->RaiseTPL (TPL_CALLBACK);
if (This == NULL || BufferSize == NULL || (*BufferSize != 0 &&
@@ -363,18 +364,22 @@ UdfRead (
Status = EFI_SUCCESS;
goto Done;
}
+ BufferSizeUint64 = *BufferSize;
+
Status = ReadFileData (
BlockIo,
DiskIo,
Volume,
Parent,
PrivFileData->FileSize,
&PrivFileData->FilePosition,
Buffer,
- (UINT64 *)(UINTN)BufferSize
+ &BufferSizeUint64
);
+ ASSERT (BufferSizeUint64 <= MAX_UINTN);
+ *BufferSize = (UINTN)BufferSizeUint64;
} else if (IS_FID_DIRECTORY_FILE (Parent->FileIdentifierDesc)) {
if (ReadDirInfo->FidOffset == 0 && PrivFileData->FilePosition > 0) {
Status = EFI_DEVICE_ERROR;
*BufferSize = 0;
It looks OK to me, and it builds fine for IA32, X64, ARM and AARCH64:
Build/ArmVirtQemu-AARCH64/DEBUG_GCC5/AARCH64/UdfDxe.efi
Build/ArmVirtQemu-ARM/DEBUG_GCC5/ARM/UdfDxe.efi
Build/OvmfIa32/NOOPT_GCC48/IA32/UdfDxe.efi
Build/OvmfX64/NOOPT_GCC48/X64/UdfDxe.efi
Green light from your side?
Yes - at least from what I've been testing :-)
Paulo: you forgot to pick up Ray's R-b for patches #4 and #5, from his
v5 response
<734D49CCEBEEF84792F5B80ED585239D5BA282B7@SHSMSX104.ccr.corp.intel.com">http://mid.mail-archive.com/734D49CCEBEEF84792F5B80ED585239D5BA282B7@SHSMSX104.ccr.corp.intel.com>
-- it was for the entire series.
D'oh - I only considered the Mde*Pkg and Nt32Pkg R-b's. Sorry.
But, I'll apply that for you.
Thank you very much!
Paulo
_______________________________________________
edk2-devel mailing list
[email protected]
https://lists.01.org/mailman/listinfo/edk2-devel
